How can you block shell access to a Proxmox node?

victorhooi

Member
Apr 3, 2018
249
18
23
35
We run a small Proxmox cluster for lab/testing.

Users have access to the Web UI, to create/spin up new VMs, and check on the status of the cluster.

Is there some permission/ACL we can use to block direct shell access to the Proxmox node?

(We are looking to roll out Teleport, or something similar and would want any users who have shell access to go through that).
 

t.lamprecht

Proxmox Staff Member
Staff member
Jul 28, 2015
5,348
1,649
164
South Tyrol/Italy
shop.proxmox.com
Hi,

Is there some permission/ACL we can use to block direct shell access to the Proxmox node?

The shell is normally only direct accessible if one is logged in as root@pam else it shows a host login prompt and one would need to know the credentials to be able to login.
That said, a user doesn't may access even the login prompt if they do not have the Sys.Console privilege on the respective /nodes/{node} path. So please check the permissions you gave those users, you may want to reduce them or use another role (you can also create custom ones).
https://pve.proxmox.com/pve-docs/chapter-pveum.html#pveum_permission_management
https://pve.proxmox.com/pve-docs/api-viewer/index.html#/nodes/{node}/termproxy
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get your own in 60 seconds.

Buy now!